fix(dns): vpn is DNS-only in code, matching live #88

Merged

jfraeys merged 1 commit from jfraeys/fix/vpn-dns-only into main 2026-10-12 23:33:35 -04:00

Conversation 0 Commits 1 Files changed 2 +15 -14

jfraeys commented 2026-10-12 23:11:34 -04:00

Owner

Copy link

The production plan has shown 'proxied = false -> true' on the vpn A/AAAA records since the DR drill: the un-proxy fix was reverted in code only and never applied. Applying it would send Headscale clients and CI (port 8443, which Cloudflare also proxies) through Cloudflare's Bot Fight Mode again.

• terraform/modules/dns: vpn proxied = false, with a two-line constraint comment.
• docs/incidents.md: follow-up entry (what happened, why, the decision, the cost: origin IP public for this name, as for git).

Verified with scripts/plan-prod.sh plan: the vpn records no longer appear in the diff. The only remaining difference is the cosmetic desec_nameservers_reminder output text. Merging this does not change production; promoting after it no longer applies a DNS change for vpn.

Follow-up PR removes the ineffective security_level_vpn Page Rule.

🤖 Generated with Claude Code

The production plan has shown 'proxied = false -> true' on the vpn A/AAAA records since the DR drill: the un-proxy fix was reverted in code only and never applied. Applying it would send Headscale clients and CI (port 8443, which Cloudflare also proxies) through Cloudflare's Bot Fight Mode again. - terraform/modules/dns: vpn proxied = false, with a two-line constraint comment. - docs/incidents.md: follow-up entry (what happened, why, the decision, the cost: origin IP public for this name, as for git). Verified with scripts/plan-prod.sh plan: the vpn records no longer appear in the diff. The only remaining difference is the cosmetic desec_nameservers_reminder output text. Merging this does not change production; promoting after it no longer applies a DNS change for vpn. Follow-up PR removes the ineffective security_level_vpn Page Rule. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

jfraeys added 1 commit 2026-10-12 23:11:34 -04:00

fix(dns): vpn is DNS-only in code, matching live; the proxied record would break Headscale on 8443 ... 6119b30b82

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

jfraeys referenced this pull request 2026-10-12 23:12:26 -04:00

chore(cloudflare): remove the ineffective vpn security_level Page Rule #89

jfraeys referenced this pull request 2026-10-12 23:16:49 -04:00

fix(dns): remove the unused mail.jfraeys.com record (Cloudflare 526) #90

jfraeys merged commit 73c06bfa7a into main 2026-10-12 23:33:35 -04:00

jfraeys referenced this pull request from a commit 2026-10-12 23:33:37 -04:00

Merge pull request 'fix(dns): vpn is DNS-only in code, matching live' (#88) from jfraeys/fix/vpn-dns-only into main

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

jfraeys/infra!88

No description provided.